diff --git a/detections/endpoint/linux_deletion_of_ssh_key.yml b/detections/endpoint/linux_deletion_of_ssh_hash_conf.yml
similarity index 97%
rename from detections/endpoint/linux_deletion_of_ssh_key.yml
rename to detections/endpoint/linux_deletion_of_ssh_hash_conf.yml
index 2123fef0d5..257159a50c 100644
--- a/detections/endpoint/linux_deletion_of_ssh_key.yml
+++ b/detections/endpoint/linux_deletion_of_ssh_hash_conf.yml
@@ -1,4 +1,4 @@
-name: Linux deletion Of SSH Key
+name: Linux deletion Of SSH Hash Conf
 id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2
 version: 1
 date: '2022-04-12'
@@ -23,7 +23,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   |rename process_guid as proc_guid
   | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action]
   | table  process_name process proc_guid file_name file_path action _time parent_process_name parent_process  process_path dest user
-  | `linux_deletion_of_ssh_key_filter`'
+  | `linux_deletion_of_ssh_hash_conf_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
diff --git a/tests/endpoint/linux_deletion_of_ssh_key.test.yml b/tests/endpoint/linux_deletion_of_ssh_hash_conf.test.yml
similarity index 70%
rename from tests/endpoint/linux_deletion_of_ssh_key.test.yml
rename to tests/endpoint/linux_deletion_of_ssh_hash_conf.test.yml
index 87f7977249..efdbb1756b 100644
--- a/tests/endpoint/linux_deletion_of_ssh_key.test.yml
+++ b/tests/endpoint/linux_deletion_of_ssh_hash_conf.test.yml
@@ -1,7 +1,7 @@
-name: Linux deletion Of SSH Key Unit Test
+name: Linux deletion Of SSH Hash Conf Unit Test
 tests:
-- name: Linux deletion Of SSH Key
-  file: endpoint/linux_deletion_of_ssh_key.yml
+- name: Linux deletion Of SSH Hash Conf
+  file: endpoint/linux_deletion_of_ssh_hash_conf.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now